• Unable to set root password with clear text using preseed/early_command

    From Glen Huang@21:1/5 to All on Tue Feb 15 13:10:01 2022
    Hi,

    I want to set the root password to a random string. this is the preseed I use:

    d-i preseed/early_command string \
    pw="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 24)"; \
    debconf-set passwd/root-password "$pw"; \
    debconf-set passwd/root-password-again "$pw"

    However, the installer still prompts me for the root password.

    Setting the crypted password works though:

    d-i preseed/early_command string \
    debconf-set passwd/root-password-crypted '<crypted-string>'

    Directly setting the password also works:

    d-i passwd/root-password password r00tme
    d-i passwd/root-password-again password r00tme

    From https://sources.debian.org/src/user-setup/1.88/user-setup-ask/#L36,
    it seems the installer will ask for the root password if
    root-password-crypted is empty or !. My guess is that in the direct
    version, somehow root-password-crypted gets a corresponding value when
    only root-password and root-password-again are set, but I couldn't
    find the code responsible for that.

    I'd be grateful if anyone could shed some light.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Geert Stappers@21:1/5 to Glen Huang on Tue Feb 15 23:10:01 2022
    On Tue, Feb 15, 2022 at 08:08:08PM +0800, Glen Huang wrote:
    Hi,

    I want to set the root password to a random string. this is the preseed I use:

    d-i preseed/early_command string \
    pw="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 24)"; \
    debconf-set passwd/root-password "$pw"; \
    debconf-set passwd/root-password-again "$pw"

    However, the installer still prompts me for the root password.

    Setting the crypted password works though:

    d-i preseed/early_command string \
    debconf-set passwd/root-password-crypted '<crypted-string>'

    Directly setting the password also works:

    d-i passwd/root-password password r00tme
    d-i passwd/root-password-again password r00tme

    From https://sources.debian.org/src/user-setup/1.88/user-setup-ask/#L36,
    it seems the installer will ask for the root password if root-password-crypted is empty or !. My guess is that in the direct
    version, somehow root-password-crypted gets a corresponding value when
    only root-password and root-password-again are set, but I couldn't
    find the code responsible for that.

    I'd be grateful if anyone could shed some light.


    Completely UNtested, a.k.a. sharing a thought:

    d-i preseed/early_command string \
    tr -dc A-Za-z0-9 </dev/urandom | head -c 24 > /tmp/pw ; \
    cat /tmp/pw | debconf-set passwd/root-password - ; \
    cat /tmp/pw | debconf-set passwd/root-password-again -


    Groeten
    Geert Stappers
    Not knowing how much of the early_command_string gets into log file.
    --
    Silence is hard to parse

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Glen Huang@21:1/5 to All on Wed Feb 16 03:00:01 2022
    Thanks for the tip.

    I’m not sure if escaping is the issue. I tried directly specifying the password:

    debconf-set passwd/root-password passwd1234
    debconf-set passwd/root-password-again passwd1234

    Still got prompted.

    I tried to debug it with

    d-i preseed/early_command string \
    set -x; \
    . /usr/share/debconf/confmodule; \
    db_set passwd/root-password passwd1234; \
    db_set passwd/root-password-again passwd1234; \
    db_input critical passwd/root-password

    And the syslog shows RET='value set’ for db_set passwd/root-password, and RET='question will be asked’ for db_input critical passwd/root-password.

    It seems the password type is somehow specially handled and could’t be set this way? But very strange that it works when specifying "d-i passwd/root-password password …” in preseed to set it. I’m still unable to locate the code that does the
    special handling for password type.

    On Feb 16, 2022, at 6:01 AM, Geert Stappers <stappers@stappers.nl> wrote:

    On Tue, Feb 15, 2022 at 08:08:08PM +0800, Glen Huang wrote:
    Hi,

    I want to set the root password to a random string. this is the preseed I use:

    d-i preseed/early_command string \
    pw="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 24)"; \
    debconf-set passwd/root-password "$pw"; \
    debconf-set passwd/root-password-again "$pw"

    However, the installer still prompts me for the root password.

    Setting the crypted password works though:

    d-i preseed/early_command string \
    debconf-set passwd/root-password-crypted '<crypted-string>'

    Directly setting the password also works:

    d-i passwd/root-password password r00tme
    d-i passwd/root-password-again password r00tme

    From https://sources.debian.org/src/user-setup/1.88/user-setup-ask/#L36,
    it seems the installer will ask for the root password if
    root-password-crypted is empty or !. My guess is that in the direct
    version, somehow root-password-crypted gets a corresponding value when
    only root-password and root-password-again are set, but I couldn't
    find the code responsible for that.

    I'd be grateful if anyone could shed some light.


    Completely UNtested, a.k.a. sharing a thought:

    d-i preseed/early_command string \
    tr -dc A-Za-z0-9 </dev/urandom | head -c 24 > /tmp/pw ; \
    cat /tmp/pw | debconf-set passwd/root-password - ; \
    cat /tmp/pw | debconf-set passwd/root-password-again -


    Groeten
    Geert Stappers
    Not knowing how much of the early_command_string gets into log file.
    --
    Silence is hard to parse


    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Glen Huang@21:1/5 to All on Wed Feb 16 05:40:01 2022
    Thanks to Cyril Brulebois’s tip that I could use DEBCONF_DEBUG to debug debconf, I found out the seen flag should be set in order for db_input to pick up the value.

    Case solved, thanks to everyone helped!

    On Feb 16, 2022, at 9:52 AM, Glen Huang <heyhgl@gmail.com> wrote:

    Thanks for the tip.

    I’m not sure if escaping is the issue. I tried directly specifying the password:

    debconf-set passwd/root-password passwd1234
    debconf-set passwd/root-password-again passwd1234

    Still got prompted.

    I tried to debug it with

    d-i preseed/early_command string \
    set -x; \
    . /usr/share/debconf/confmodule; \
    db_set passwd/root-password passwd1234; \
    db_set passwd/root-password-again passwd1234; \
    db_input critical passwd/root-password

    And the syslog shows RET='value set’ for db_set passwd/root-password, and RET='question will be asked’ for db_input critical passwd/root-password.

    It seems the password type is somehow specially handled and could’t be set this way? But very strange that it works when specifying "d-i passwd/root-password password …” in preseed to set it. I’m still unable to locate the code that does the
    special handling for password type.

    On Feb 16, 2022, at 6:01 AM, Geert Stappers <stappers@stappers.nl> wrote:

    On Tue, Feb 15, 2022 at 08:08:08PM +0800, Glen Huang wrote:
    Hi,

    I want to set the root password to a random string. this is the preseed I use:

    d-i preseed/early_command string \
    pw="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 24)"; \
    debconf-set passwd/root-password "$pw"; \
    debconf-set passwd/root-password-again "$pw"

    However, the installer still prompts me for the root password.

    Setting the crypted password works though:

    d-i preseed/early_command string \
    debconf-set passwd/root-password-crypted '<crypted-string>'

    Directly setting the password also works:

    d-i passwd/root-password password r00tme
    d-i passwd/root-password-again password r00tme

    From https://sources.debian.org/src/user-setup/1.88/user-setup-ask/#L36, >>> it seems the installer will ask for the root password if
    root-password-crypted is empty or !. My guess is that in the direct
    version, somehow root-password-crypted gets a corresponding value when
    only root-password and root-password-again are set, but I couldn't
    find the code responsible for that.

    I'd be grateful if anyone could shed some light.


    Completely UNtested, a.k.a. sharing a thought:

    d-i preseed/early_command string \
    tr -dc A-Za-z0-9 </dev/urandom | head -c 24 > /tmp/pw ; \
    cat /tmp/pw | debconf-set passwd/root-password - ; \
    cat /tmp/pw | debconf-set passwd/root-password-again -


    Groeten
    Geert Stappers
    Not knowing how much of the early_command_string gets into log file.
    --
    Silence is hard to parse



    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Philip Hands@21:1/5 to Glen Huang on Wed Feb 16 09:40:01 2022
    Glen Huang <heyhgl@gmail.com> writes:

    Thanks to Cyril Brulebois’s tip that I could use DEBCONF_DEBUG to debug debconf, I found out the seen flag should be set in order for db_input to pick up the value.

    Case solved, thanks to everyone helped!

    I was wondering about that, but didn't see my code setting lots of seen
    flags, so wasn't sure.

    I now realise that the reason for that is that I generally preseed the
    things I don't want to be asked, even if I'm going to set them via
    script, and the act of preseeding them to a place-holder value also sets
    the seen flag. Then you get to override that in a script without
    worrying about also setting the seen flag at that point.

    Cheers, Phil.
    --
    |)| Philip Hands [+44 (0)20 8530 9560] HANDS.COM Ltd.
    |-| http://www.hands.com/ http://ftp.uk.debian.org/
    |(| Hugo-Klemm-Strasse 34, 21075 Hamburg, GERMANY

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEE3/FBWs4yJ/zyBwfW0EujoAEl1cAFAmIMuBkACgkQ0EujoAEl 1cDrvg//UKlrXdqaIoVBwIFnf0HB1iGhe1hHV5ZNng2VY98apBu2i/58ayCfpCex taSeQTLNGCVZvifh3WwaSIc2rNSziWkuk4PHyKnlJfVmZWtP2Ec/A6iIDw2+wPB8 jlxJnEvom5tbIvkMDpAHFQzfMZfiJ0D1/eKQKJbmpmHrNtrk2SeMV58u+rmm13L/ NhyYIqP+Mv5BC+zjGIhKCbe9JSrLnxHlskrL39NVZRgQQx/pOkzsvbKT2qM+H+OY fqQDjgx4INv5JhUjRlabRFsH+Lezgp2CwXVqU/vT5MNEmZ8GfvSezobtmSdD1cAp sPQU6NYHvVzUImpDC+7X8ZlOftrvkfV5WJyeG2b8MaZGbRvQSFMq10/VuBW5hF6N udjq+5nFjwHqdQrZ/XcWdvXI/pDHFzFzeDBr83DMSl2RqQVHLkPSyjjXeI514olX Cr60D8Kw1zMVv8K6vrbrfBexGcHgpvuWO0+h5Fkmxvv6wPvSXuArydLkMfmGHRhd aVj2jU6b1HX5g/2nnEW1yPLqNIXejlJSXQZEYFfa8E5BoNEg4DEY7r7XthZLyNE0 m7YBImcZK576ijgyDtF25eBX0ngDqZlKyoyumtBB89A+qlXFd6j8tpdwzeTprq4u nlt5M3BhtfLb1zf
  • From Glen Huang@21:1/5 to All on Wed Feb 16 10:00:01 2022
    Setting a placeholder value is a great idea, it simplifies the early_command since the seen flag no longer needs to be set.

    Thanks for the tip Philip.

    On Feb 16, 2022, at 4:38 PM, Philip Hands <phil@hands.com> wrote:

    Glen Huang <heyhgl@gmail.com> writes:

    Thanks to Cyril Brulebois’s tip that I could use DEBCONF_DEBUG to debug debconf, I found out the seen flag should be set in order for db_input to pick up the value.

    Case solved, thanks to everyone helped!

    I was wondering about that, but didn't see my code setting lots of seen flags, so wasn't sure.

    I now realise that the reason for that is that I generally preseed the
    things I don't want to be asked, even if I'm going to set them via
    script, and the act of preseeding them to a place-holder value also sets
    the seen flag. Then you get to override that in a script without
    worrying about also setting the seen flag at that point.

    Cheers, Phil.
    --
    |)| Philip Hands [+44 (0)20 8530 9560] HANDS.COM Ltd.
    |-| http://www.hands.com/ http://ftp.uk.debian.org/
    |(| Hugo-Klemm-Strasse 34, 21075 Hamburg, GERMANY

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From More Thanks@21:1/5 to Glen Huang on Wed Feb 16 10:40:01 2022
    On Wed, Feb 16, 2022 at 04:52:48PM +0800, Glen Huang wrote:
    On Feb 16, 2022, at 4:38 PM, Philip Hands <phil@hands.com> wrote:
    Glen Huang <heyhgl@gmail.com> writes:
    Thanks to Cyril Brulebois’s tip that I could use DEBCONF_DEBUG
    to debug debconf, I found out the seen flag should be set in order
    for db_input to pick up the value.

    Case solved, thanks to everyone helped!

    I was wondering about that, but didn't see my code setting lots of seen flags, so wasn't sure.

    I now realise that the reason for that is that I generally preseed the things I don't want to be asked, even if I'm going to set them via
    script, and the act of preseeding them to a place-holder value also sets the seen flag. Then you get to override that in a script without
    worrying about also setting the seen flag at that point.


    Setting a placeholder value is a great idea, it simplifies the
    early_command since the seen flag no longer needs to be set.

    Thanks for the tip Philip.

    Thank your future self by sharing your solution with the mailinglist.

    Karma bonus points for making it possible to read in the discussion
    order. (In other words: Put responses **below** previous text.)


    Groeten
    Geert Stappers
    --
    Silence is hard to parse

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Brian Potkin@21:1/5 to More Thanks on Fri Feb 18 19:50:01 2022
    On Wed 16 Feb 2022 at 10:32:25 +0100, More Thanks wrote:

    On Wed, Feb 16, 2022 at 04:52:48PM +0800, Glen Huang wrote:
    On Feb 16, 2022, at 4:38 PM, Philip Hands <phil@hands.com> wrote:
    Glen Huang <heyhgl@gmail.com> writes:
    Thanks to Cyril Brulebois’s tip that I could use DEBCONF_DEBUG
    to debug debconf, I found out the seen flag should be set in order
    for db_input to pick up the value.

    Case solved, thanks to everyone helped!

    I was wondering about that, but didn't see my code setting lots of seen flags, so wasn't sure.

    I now realise that the reason for that is that I generally preseed the things I don't want to be asked, even if I'm going to set them via script, and the act of preseeding them to a place-holder value also sets the seen flag. Then you get to override that in a script without worrying about also setting the seen flag at that point.


    Setting a placeholder value is a great idea, it simplifies the early_command since the seen flag no longer needs to be set.

    Thanks for the tip Philip.

    Thank your future self by sharing your solution with the mailinglist.

    Geert Stappers is not the only one who would like to know your solution.
    Detail appreciated.

    --
    Brian.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)